108 lines
1.9 KiB
Markdown
108 lines
1.9 KiB
Markdown
---
|
|
publish: true
|
|
permalink: /os/keychain
|
|
title: Keychain
|
|
created: 2026-01-29T21:15:48.335-07:00
|
|
modified: 2026-02-05T12:18:02.157-07:00
|
|
tags:
|
|
- security
|
|
- secrets
|
|
- gnome-keyring
|
|
cssclasses: ""
|
|
---
|
|
|
|
GNOME Keyring for managing secrets, SSH keys, and application passwords.
|
|
|
|
## Installation
|
|
|
|
```bash
|
|
sudo pacman -S gnome-keyring libsecret seahorse
|
|
```
|
|
|
|
- `gnome-keyring` — The keyring daemon
|
|
- `libsecret` — Library for apps to access secrets
|
|
- `seahorse` — GUI for managing keyring
|
|
|
|
## PAM Integration
|
|
|
|
Automatically unlock keyring on login.
|
|
|
|
Edit `/etc/pam.d/login`:
|
|
```
|
|
auth optional pam_gnome_keyring.so
|
|
session optional pam_gnome_keyring.so auto_start
|
|
```
|
|
|
|
For GDM/SDDM, also edit `/etc/pam.d/passwd`:
|
|
```
|
|
password optional pam_gnome_keyring.so
|
|
```
|
|
|
|
## Hyprland Integration
|
|
|
|
Add to `~/.config/hypr/hyprland.conf`:
|
|
```bash
|
|
exec-once = gnome-keyring-daemon --start --components=secrets,ssh
|
|
```
|
|
|
|
Set environment variables in hyprland.conf:
|
|
```bash
|
|
env = SSH_AUTH_SOCK,$XDG_RUNTIME_DIR/gcr/ssh
|
|
```
|
|
|
|
Or in your shell profile:
|
|
```bash
|
|
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/gcr/ssh"
|
|
```
|
|
|
|
## SSH Key Management
|
|
|
|
### Add key to agent
|
|
|
|
```bash
|
|
ssh-add ~/.ssh/id_ed25519
|
|
```
|
|
|
|
### List keys
|
|
|
|
```bash
|
|
ssh-add -l
|
|
```
|
|
|
|
### GUI management
|
|
|
|
Launch Seahorse:
|
|
```bash
|
|
seahorse
|
|
```
|
|
|
|
## Unlocking
|
|
|
|
If keyring doesn't auto-unlock:
|
|
|
|
```bash
|
|
# Manually unlock
|
|
gnome-keyring-daemon --unlock
|
|
|
|
# Or via secret-tool
|
|
secret-tool search --unlock xdg:schema org.gnome.keyring.Note
|
|
```
|
|
|
|
## Application Support
|
|
|
|
Apps using libsecret (most modern apps) will automatically use gnome-keyring. For apps that need explicit setup:
|
|
|
|
### Git credential storage
|
|
|
|
```bash
|
|
git config --global credential.helper /usr/lib/git-core/git-credential-libsecret
|
|
```
|
|
|
|
### VS Code
|
|
|
|
VS Code uses gnome-keyring automatically for settings sync.
|
|
|
|
## Resources
|
|
|
|
- Arch Wiki: https://wiki.archlinux.org/title/GNOME/Keyring
|